Facebook removes Russian propaganda outlet in Ukraine

The social network took down assets connected to News Front and South Front, propaganda websites supportive of Russian security services

@DFRLab
@DFRLab
May 5, 2020 · 13 min read
(Source: @KaranKanishk/DFRLab)

On April 30, as part of a larger takedown, Facebook removed 140 assets connected to Russian propaganda outlets News Front and South Front, of which the DFRLab had access to a subset of 69 assets.

Most of the pages and groups the DFRLab had access to had clear connections to News Front and South Front. While the DFRLab found instances of inauthenticity and of coordination but could not connect them, it also found no evidence to contradict Facebook’s findings of coordinated inauthentic behavior (CIB). Facebook designates assets for removal under CIB when accounts, pages, groups, or other assets intentionally mislead users.

In this case, according to its statement, the company removed the assets because:

The individuals behind this activity relied on a combination of authentic, duplicate and fake accounts — many of which had been previously detected and disabled by our automated systems. They used fake accounts to post their content and manage Groups and Pages posing as independent news entities in the regions they targeted. This network posted ​about geopolitical and local news including topics such as the military conflict in Ukraine, the Syrian civil war, the annexation of Crimea, NATO, US elections, and more recently the coronavirus pandemic​. ​Our investigation linked this activity to individuals in Russia and Donbass, and two media organizations in Crimea — NewsFront and SouthFront.

Registered as a private company, News Front Ltd. received a Russian state licenses to operate as an information agency in June 2015 and as a TV channel in February 2017, according to public data. The company was established by Konstantin Knyrik, the head of News Front, and Mikhail Synelin, who has held various positions in the Russian government or in state-affiliated entities from the leadership of the government secretariat to deputy chairman of the state corporation “Bank for Development and Foreign Economic Affairs.” Finally, he is also brother-in-law to Sergey Glazyev, an advisor to Russian President Vladimir Putin from 2012 to 2019.

The flagship News Front outlet has about 12 full-time staff, more than 100 contributors, and a disclosed fiscal budget of 712,000 rubles (around $12,200; for 2017). According to “a former News Front staffer” in an article from German outlet Zeit, the outlet is funded by the FSB, the Russian intelligence services. The outlet started off as a Russian federal agency outlet but, in April 2015, switched to ostensibly being a private news agency, according to data from Russian tax authorities.

The motives of the operation bear close resemblance to what the DFRLab observed in a previous takedown of assets belong to Iranian company IUVM, a messaging laundromat that Facebook de-platformed for pushing pro-Iranian information operations. Like PressTV and Mehr, IUVM’s ownership was a puzzle, but the content showed clarity in its pro-Iranian geopolitical objective. Similar to that, News Front and South Front are thinly disguised propaganda outlets for pro-Russia content.

The DFRLab has covered News Front’s propagation of Russian propaganda previously, from its role in spreading messages against the migration movement in Germany to its projection of false equivalence between the independence movement in Catalonia and the “Republics” movement in the Donbas.

Just like mainstream Russian media outlets such as RT or Sputnik, the website’s content exhibits an anti-Western bias and promotes the Kremlin’s stance on certain issues. The dissemination of the content was made effective through the distortion of facts, projection of false equivalence, use of photoshopped content, and amplification of Kremlin talking points, all in service of Russia’s geopolitical agenda.

One of the assets taken down was News Front’s official Facebook page.

The Facebook icon on News Front’s main page hyperlinked to the “NewsFront.info” Facebook page. (Source: @KaranKanishk/DFRLab via News Front/archive, left)

Most of the assets that DFRLab had access to did not hide their connection to South Front or News Front. Many of the pages wore their connections on their sleeves, naming themselves as different language versions of the websites.

An English variation of the main “South Front” page, @SouthFrontEnTwo, was among the pages removed. (Source: Facebook)

Others in the set were not named as directly, but nevertheless included links to the News Front website in the “About” section of their main page.

Many of the pages, including “ukpolitics.actual” had links to the external News Front website listed in their “About” section. (Source: Facebook)

Some of the removed assets also demonstrated a close relationship by liking each other’s pages.

Some of the News Front pages liked others in the set, creating a network of cross-promotional liking. (Source: Facebook)

The DFRLab also found suspicious links to another Russian propaganda outlet, ANNA News. Some of the administrators of some of the pages previously worked at ANNA News, an Abkhazian news agency that pushes a pro-Kremlin agenda.

Two of the removed pages, “Catherine Nollan” and “Ellen Krasovskaya,” were dedicated to anchors for News-Front.info who were formerly with Anna News.

Catherine Nollan (top) and Ellen Krasovskaya (bottom) were formerly anchors for ANNA News. (Source: YouTube, top; Facebook, bottom)

“Anastasia Shkitina,” an account listed as the creator of one of the removed groups, “NewsFront auf Deutsch,” was also a former ANNA News employee.

Anastasia Shkitina’s account biography, indicating she was a former journalist at ANNA News. (Source: Facebook)

An account seemingly belonging to former ANNA News anchor “Catherine Nollan,” as mentioned above, was also listed as an administrator for the same group.

The account “Catherine Nollan” was also listed as an administrator for the “NewsFront auf Deutsch” group. (Source: Facebook)

Catherine Nollan had a duplicate account, which seemed inactive at the time of the takedown but may have been intended as a secondary account to post News Front content.

The biography section of the duplicate “Catherine Nollan” account highlighted her past work experience with Anna News. (Source: Facebook)

Catherine’s main account also listed itself as “CEO of News Front.”

The “Catherine Nollan” account listed itself as CEO of News Front. (Source: Facebook)

Both Catherine Nollan accounts, along with the “Anastasia Shkitina” account, were among those removed in the takedown. Although these accounts may have been real identities, other accounts had pilfered profile photos or stolen names, such as an account that used a picture of former British Prime Minister David Cameron as its profile photo and named itself after comedian Yakov Smirnoff (“Яков Смирнов”).

An account used a picture of David Cameron, former Prime Minister of the United Kingdom, in its profile and had the name “Yakov Smirnoff” (in Cyrillic). The account amplified content from pages linked to South Front. (Source: Facebook)

Though the DFRLab did not find that the accounts involved used inauthentic means at scale, there were clear attempts to use sockpuppet accounts to push content, especially in promoting News Front and South Front stories.

Moreover, a few accounts shared verbatim posts across various groups that discuss political issues, often on the same day. This behavior, while not necessarily inauthentic, showed attempts to gain visibility in these groups on political issues.

Some of the groups shared verbatim text across groups about political issues. (Source: Facebook)

One of the removed pages, “Front.TV,” sought to raise funds for ANNA News in October 2014, but at the time of its removal had been posting News Front content for several years. Archived copies of the News-front.info website shows that the website’s social media icons linked to the same Front.TV Facebook page between December 21, 2014 and May 15, 2016, when it switched to the Newsfront.info Facebook page.

The page Front.TV, part of the News Front Facebook operation, featured a post trying to raise funds for ANNA News in October 2014. (Source: Facebook)

The links to other pro-Kremlin outlets indicated that News Front may be part of a broader Russian media ecosystem.

“Ellen Krasovskaya,” one of the removed pages, was dedicated to the eponymous anchor for News Front and ANNA News mentioned above. The page posted links to News Front articles that were outright disinformation. For instance, the page posted a link to a News Front story that denied the culpability of Russian-backed separatists’ involvement in the shoot-down of Malaysia Airlines MH-17 in eastern Ukraine in July 2014.

Screenshot of post regarding the MH-17 conspiracy shared by the “Ellen Krasovskaya” page. (Source: Facebook)

The Joint Investigative Team, an international coalition assembled to investigate the tragedy, determined separatists to have been behind the MH-17 shootdown; after issuing the determination, the organization pursued criminal proceedings against four individuals. Also, the involvement of the two so-called “republics” (the “Luhansk People’s Republic” and the “Donetsk People’s Republic”) in eastern Ukraine was proven by open-source evidence collected by Bellingcat, a citizen journalist investigations outlet.

The “Ellen Kraskovskaya” page also posted a story blaming the U.S. representative in the Organization for Security and Co-operation in Europe (OSCE) for false accusations and aggressive statements and claiming that the U.S. representative had called for “liquidation” of the “republics’” administration before elections could be held under Ukrainian law in the Donbas region. The piece erroneously translated the word “dismantled” to mean “liquidation,” implying the physical extermination of the governmental personnel of the so-called “republics.”

Screenshot of post criticizing the U.S. representative to the OSCE shared by the “Ellen Krasovskaya” page. (Source: Facebook)

Another of the removed pages, Front.TV, served as a platform to amplify News Front articles, especially those dedicated to Syria and the MH-17. The page also promoted “Ukraine: Masks of Revolution,” a French documentary that nonprofit fact-checking organization StopFake criticized for “mirroring the ideology traditionally put forth by pro-Russian channels” and “build[ing the] story on factual mistakes.” The page also provided consistent coverage on shelling by the Ukrainian side of the conflict in eastern Ukraine but ignored any similar attacks by Russian-backed separatists. The most recent post on the page was published on February 12, 2016.

Screenshots of the Front.TV page’s promotion of debunked “documentary,” “Ukraine: Masks of Revolution.” (Source: Facebook)

News Front and South Front both used false equivalence and distortion to manipulate the information environment. South Front features similar content to News Front, but the former mostly posts military-related analysis. According to EUvsDisinfo, the outlet shares Russian talking points “verbatim” and is “frequently featured in [its] database of cases of disinformation.” Moreover, EUvsDisinfo has compared South Front’s modus operandi to that of New Eastern Outlook, another English-language, pro-Russian outlet that featured in Facebook takedown of Thai assets on July 2019.

Posts shared by a page dedicated to South Front showing a clear military focus. (Source: Facebook)

One of the pages posting South Front links, “ZuidFront,” spread anti-EU, anti-U.S., and pro-Kremlin messages in both the Dutch and English languages.

Some of the content from the page targeted Western narratives by pushing a false equivalence, such as comparing the conflict in the Donbas region of Ukraine (a proxy war between Ukraine and Russia) with Brexit (a geopolitical event decided by democratic vote).

Image posted to the Zuidfront page using a false equivalence to compare the war in the Donbas with Brexit, a comparison that echoes Russia’s interest. (Source: Facebook)

Another of the removed pages, “South Front Nederlands,” openly acknowledged its affiliation with South Front and posted consistent pro-Kremlin coverage of the conflict in Syria. Among other things, the page amplified conspiracy theories about the downing of MH-17, putting the blame on the Ukrainian government.

Screenshots of a conspiracy that Ukrainian SU-25 shot down MH-17 spread by South Front Nederlands. (Source: Facebook)

The “About” section of the page stated that it was devoted to translating South Front’s English language articles into Dutch. The page had been active since November 2017.

Screenshot of “South Front Nederlands” About section. (Source: Facebook)

Another of the pages amplifying News Front articles, “Donbass Back To Russia,” had 6,713 followers and posted pro-Russian, pro-separatist news regarding the conflict in the Donbas region of eastern Ukraine, including posts that were overtly pro-independence for the Donbas “republics.” The “About” section for the page listed a link to a WordPress blog called “Narodni Eurasia.” The blog is now defunct, but a search on archive.is showed a post from May 2015 that included screencaps from a News Front video.

An archive.is capture of now defunct WordPress blog Narodni Eurasia that included posts promoting News Front content. (Source: archive.is)

Other posts used photoshopped, fabricated, and defamatory images to target Western politicians, including a photo of Hillary Clinton posted ahead of the 2016 presidential elections that supposedly showed her shaking hands with Osama bin Laden. The Photoshopped image superimposed bin Laden’s head on the body of Indian musician Shubhashish Mukherjee, who can be seen meeting Clinton at a 2004 event in the original photo.

The page also posted several times on a supposed Russian humanitarian aid convoy to the Donbas. The OSCE, however, cast doubt on what the contents of these alleged aid trucks actually were.

The page stopped publishing in June 2017.

Donbass Back To Russia posted a photoshopped meme of Hillary Clinton (left) and photo of an alleged Russian humanitarian aid convoy (right). (Source: Facebook)

Some of the pages in the set promoted terminology and concepts pushed by Russia. One such term, “Novorossiya,” appeared on the Donbass Back To Russia page.

A post to Donbass Back To Russia used a term, “Novorossiya,” that is favored by Russia when referring to the Donbas region of eastern Ukraine. (Source: Facebook)

The term gained momentum among Russian media and policy circles after Putin used it in 2014 as a means of implying Russia’s sovereignty over the Donbas. The term has since fallen out of favor.

Some of the pages taken down focused beyond Ukraine, offering alternative views to Western reporting more generally.

One page, for instance, was dedicated to Bulgaria, and published an article criticizing the European Union’s response to the coronavirus pandemic.

“News Front — Bulgaria” targeted the European Union in a post amplifying a News Front article on the union’s coronavirus response. (Source: Facebook)

Beyond the assets focused on Ukraine and the European Union, other assets — such as the pages “Agencia de Noticias News Front En Español” (“News Front Outlet In Spanish”) and “Novorossia Today En Español” (“Novorossia Today In Spanish”) targeted Latin American audiences with posts linking to News Front articles in Spanish that focused on Brazil, Bolivia, Mexico, and Venezuela. Most of this content aimed to highlight the failings and supposed successes of Latin American leaders, including Brazil’s Jair Bolsonaro, Bolivia’s Evo Morales, Venezuela’s Nicolas Maduro, and Mexico’s Lopez Obrador.

News Front’s Facebook posts on Brazil, Bolivia, Mexico, and Venezuela. These posts include links to articles published on the News Front’s site criticizing the leadership of various Latin American heads of state. (Source: Facebook)

These articles, however, were not original content: they were taken from state-funded media outlets, such as the Russian-funded Sputnik, Tass, Ria, and RT, the Venezuelan-funded TeleSurTV, and the Iranian state-funded HispanTV. News Front used the same content from those outlets and amplified them on its site, linking back to the original content.

Articles from News Front’s Spanish edition took language directly from articles published on the Iranian outlet HispanTV and Russian Sputnik, respectively. (Source: News Front/archive, top left; Sputnik/archive , top right; News Front/archive, bottom left; HispanTV/archive, bottom right)

The DFRLab collected a sample of news links published in the HTML source-code of the News Front Spanish version’s homepage, es.newsfront.info. In total, the DFRLab extracted 74 URLs from news published between December 2019 to April 2020. The data showed that media outlet Sputnik has been amplified by the website most often, followed by Tass and RT.

The most linked-to sources by News Front in Spanish. (Source: @estebanpdl/DFRLab)

According to a search using the social media listening tool CrowdTangle, this sample of news links garnered 440 likes and 145 shares in total. Among those groups sharing News Front Spanish content were accounts supporting Vladimir Putin, Venezuela’s Nicolas Maduro, and groups identifying themselves as “friends of Russia.”

The chart shows Facebook groups sharing News Front content in Spanish. (Source: @estebanpdl/DFRLab)

Using the CooRnet R package, the DFRLab also identified accounts that engaged in coordinated link-sharing behavior. Given a set of URLs, the package determines a coordination interval for shared links — a time threshold that identifies which of the same links were shared by different pages within an unusually short period of time, on a repeated basis. Public Facebook entities that repeatedly shared the same links within that threshold are deemed as engaging in coordinated link-sharing behavior with one another. The analysis identified the groups “Apoyo a Vladimir Putin” (“I support Vladimir Putin”), “Todos con Rusia” (“Everybody with Russia”),Pueblos en resistencia” (“People’s resistance”), and “Pueblos que resisten al imperialismo” (“People’s resistance to imperialism”) as coordinating on posting links.

The most connected Facebook groups sharing News Front content in Spanish, as determined by the CooRnet package. These groups are connected because they repeatedly shared the same links within an unusually short period of time, demonstrating a degree of coordination. (Source: @estebanpdl/DFRLab via CooRnet)

Facebook also removed News Front assets that operated in the Georgian language and amplified content published by the News Front Georgian edition. Multiple inauthentic fake accounts were posting openly pro-Russian and anti-Western content in Facebook groups, which aimed to antagonize society against the West and portray Russia as a more reliable partner for Georgia.

News Front and South Front are propaganda outlets dedicated to posting pro-Kremlin and anti-Western stories, especially on Ukraine. Both outlets demonstrate similarity in ideology and tactics to their more overtly Russia-backed counterparts, such as Sputnik and RT, and some of its foreign language versions — such as its Spanish-language edition — openly repost content from those same Russian state-backed entities.

When they first surfaced in the Ukrainian media environment, News Front and South Front appeared to be fringe media outlets. The extent to which their ideological messaging cohered with that of the Kremlin, especially on topics like the downing of Flight MH-17, raised suspicion of their links to the Russian security services.

A defining feature of this operation was its scope: the removed assets disseminated pro-Kremlin propaganda in an array of languages, indicating that they were attempting to reach a diverse, international audience beyond Russia.

Kanishk Karan is a Digital Forensic Research Associate with the Digital Forensic Research Lab.

Roman Osadchuk is a Research Assistant, Eurasia, with the Digital Forensic Research Lab.

Givi Gigitashvili is Research Assistant, Caucasus, with the Digital Forensic Research Lab.

Esteban Ponce de León is a Research Assistant, Latin America, with the Digital Forensic Research Lab.

Jean Le Roux is a Research Associate, Southern Africa, with the Digital Forensic Research Lab.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Medium is an open platform where 170 million readers come to find insightful and dynamic thinking. Here, expert and undiscovered voices alike dive into the heart of any topic and bring new ideas to the surface. Learn more

Follow the writers, publications, and topics that matter to you, and you’ll see them on your homepage and in your inbox. Explore

If you have a story to tell, knowledge to share, or a perspective to offer — welcome home. It’s easy and free to post your thinking on any topic. Write on Medium

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store